Create Malware Evasion via AV Process Detection

[malfav]

Technique Name: Malware Evasion via AV Process Detection

Author Information

• Nickname: Malfav.Win32
• First Name: Diyar
• Last Name: Saadi
• Website: malfav.gitbook.io/home
• GitHub: github.com/malfav
• LinkedIn: Diyar Saadi

Technique Information

• Technique Category: Defense Evasion
• Technique Tags: Antivirus Exception, Malware Evasion
• Technique General Detail:

This technique involves searching for active antivirus-related processes or modules and terminating execution if any are found. By detecting loaded antivirus libraries, malware can determine whether it is running in a monitored environment and exit to avoid detection.

Additional Resources:

• Technique Reference: https://unprotect.it/technique/adding-antivirus-exception/
• Technique Rule Reference : https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml

Code Snippet Information

• Code Snippet Author: Malfav.Win32
• Programming Language: Python

Code

import ctypes
import psutil
import sys

def is_av_present():
    av_signatures = [
        "avghookx.dll", "avghooka.dll",  # AVG
        "snxhk.dll", "sf2.dll",  # Avast
        "sbiedll.dll",  # Sandboxie
        "dbghelp.dll",  # WindBG, WINE
        "api_log.dll", "dir_watch.dll",  # iDefense Lab
        "pstorec.dll",  # SunBelt Sandbox
        "vmcheck.dll",  # Virtual PC
        "wpespy.dll",  # WPE Pro
        "cmdvrt64.dll", "cmdvrt32.dll",  # Comodo Container
        "sxin.dll",  # 360 SOFTWARE
        "printfhelp.dll",  # Unknown Sandbox
        "ekrn.exe",  # ESET
        "avguard.exe", "avscan.exe",  # Avira
        "ccSvcHst.exe", "norton.exe",  # Norton
        "mcshield.exe", "mcupdate.exe",  # McAfee
        "fsav.exe", "fsgk32.exe",  # F-Secure
        "kav.exe", "kavsvc.exe",  # Kaspersky
        "msmpeng.exe", "mpcmdrun.exe"  # Windows Defender
    ]

    for proc in psutil.process_iter(attrs=['pid', 'name']):
        try:
            if any(av.lower() in proc.info['name'].lower() for av in av_signatures):
                print(f"Detected AV process: {proc.info['name']} (PID: {proc.info['pid']})")
                return True
        except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
            pass
    return False

if is_av_present():
    print("Antivirus detected! Exiting process to avoid detection.")
    sys.exit(0)

print("No antivirus detected. Proceeding with execution.")